FaveCard Sub-processors List
What this page is
This page lists the third-party sub-processors that FaveCard (Qualityc Łukasz Fryc, NIP 7372138804, EU VAT PL7372138804) engages to help deliver the Service. Sub-processors are third parties that may process personal data on our behalf. They are part of the Service infrastructure, and their involvement is authorised by you when you accept our Data Processing Agreement.
This list is part of the Data Processing Agreement and is incorporated into it by reference. It also satisfies the transparency obligation we owe to business customers under Article 28(2) and (4) of the GDPR.
Last updated: 2026-10-22 Effective: 2026-04-21
How changes to this list work
We may add, replace, or remove sub-processors from time to time as the Service evolves. When that happens:
- We update this page first.
- We notify subscribed business customers at least 30 calendar days in advance of the new sub-processor beginning to process data (except for emergency replacements required for security or legal reasons, which are handled as soon as practicable with notice).
- You have 10 calendar days from notification to object on reasonable grounds related to data protection. If the objection cannot be resolved, you may terminate the affected subscription with a prorated refund for any prepaid Fees covering the period after termination.
Subscribe to updates
Business customers can subscribe to sub-processor change notifications by emailing privacy@favecard.co with the subject line "Subscribe sub-processor updates".
Current sub-processors
The table below lists every sub-processor currently engaged by FaveCard, together with the categories of personal data they may process, their region of processing, and the legal mechanism we rely on for any international transfer of personal data to them.
| # | Sub-processor | Purpose | Personal data categories | Region of processing | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | Google Cloud Platform (Google Ireland Limited / Google LLC) | Application hosting, serverless compute (Cloud Functions), database (Firestore), file storage (Cloud Storage), static hosting (Firebase Hosting) | Business-customer account data, end-customer loyalty data, authentication tokens, server logs | europe-west4 (Eemshaven, Netherlands) for Cloud Functions; eur3 multi-region (Netherlands + Belgium) for Firestore | EU processing (no transfer); fallback to EU 2021 SCCs Module 3 + DPF where data crosses to Google LLC US (e.g. control-plane access) |
| 2 | Apple Push Notification Service (Apple Inc. / Apple Distribution International Ltd.) | Delivery of updates to Apple Wallet passes on end-customer devices | Wallet pass tokens, pass update payloads (business name, stamp count, rewards text) | United States | EU 2021 SCCs Module 3 + DPF |
| 3 | Google Wallet API (Google LLC) | Generation of Google Wallet passes for Android end-customers | Pass payload (business name, stamp count, rewards text, card identifier), end-customer first name | United States (with some EU fallback) | EU 2021 SCCs Module 3 + DPF |
| 4 | Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States) | Processing of subscription payments from business customers; billing; fraud prevention | Business-customer billing identification, payment method token, invoice history. Full card numbers and CVV are handled by Stripe directly and never reach FaveCard. | Primary: Ireland (EU); some fraud and compliance processing in the US | EU 2021 SCCs Module 1 (C2C, because Stripe is an independent controller for fraud prevention) + DPF |
| 5 | Resend (Plus Five Five, Inc., doing business as Resend, United States) | Delivery of transactional email (pass-ready emails, password reset, receipts, onboarding) from notify.favecard.co | Recipient email address, recipient first name, email body (which may include Issuer-specific content), delivery status | United States | EU 2021 SCCs Module 3 + DPF |
| 6 | Sentry (Functional Software, Inc., doing business as Sentry, United States) | Application error monitoring and performance tracing | Error traces, stack traces, user agent, IP address (truncated where possible), Firebase Auth user identifier | EU region (Frankfurt, Germany) | EU processing (no transfer); fallback to EU 2021 SCCs Module 3 + DPF for control-plane access by Sentry US staff |
| 7 | PostHog (PostHog, Inc., United States / Hiberly Ltd., United Kingdom) | Product analytics and usage insights for the business dashboard and Flutter app | Business-customer identifier (pseudonymous), dashboard events, device and browser information, approximate location derived from IP | EU instance — eu.posthog.com (Frankfurt, Germany) | EU processing (no transfer) |
| 8 | Vercel (Vercel Inc., United States) | Hosting of the public business page (business-page-next) and the end-customer card-signup flow | HTTP request logs, IP address, user agent, form submissions in transit | cdg1 (Paris, France) for edge and primary region; build and control plane in the United States | EU processing for runtime; EU 2021 SCCs Module 3 + DPF for US control-plane access |
| 9 | Cloudflare (Cloudflare, Inc., United States) | Bot protection on the FaveCard sign-up and waitlist forms (Cloudflare Turnstile). Cloudflare also uses these signals, as an independent controller, to improve its bot detection (Turnstile Privacy Addendum) | The visitor's IP address, user agent and TLS fingerprint, the form's site key and page address. No name, e-mail address or form content | Cloudflare's global network (the data centre nearest the visitor), including outside the EEA | DPF (Cloudflare, Inc. is certified); EU 2021 SCCs Module 2 under Cloudflare's Data Processing Addendum; its independent-controller use relies on the DPF |
| 10 | Trustpilot (Trustpilot A/S, Denmark) | Review invitations: after a business customer buys a paid plan, our founder's thank-you email is also sent as a blind copy (BCC) to Trustpilot's invitation address, and Trustpilot invites the buyer to review FaveCard | The buyer's email address, first name, business name and the language of the email, as they appear in that email. No end-customer data | EEA and UK (Trustpilot A/S is in Denmark) | Outside the EEA and the UK only with the measures data protection law requires (Trustpilot's Data Processing Agreement) |
Notes on the table
- The region of processing column reflects where data is stored and processed at rest for the primary path. Some sub-processors replicate data across regions (for example, Firestore's
eur3multi-region spans Belgium and the Netherlands); those replicas remain within the EU. - The transfer mechanism column applies only to flows where personal data is transferred outside the European Economic Area. Where both parties are in the EU, no transfer mechanism is needed under Chapter V of the GDPR.
- References to "DPF" mean the EU–US Data Privacy Framework adequacy decision (July 2023). Where a specific US sub-processor has not self-certified under the DPF, we fall back to the EU 2021 Standard Contractual Clauses alone. We will update this page if the DPF is invalidated.
- References to "SCCs" mean the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
Sub-processor details and DPAs
For each sub-processor, the link below points to the sub-processor's own data processing terms, which form the basis of our engagement with them.
- Google Cloud Platform — Cloud Data Processing Addendum
- Apple Push Notification Service — governed by the Apple Developer Program License Agreement and the Apple Privacy Policy. Apple Privacy Governance
- Google Wallet API — Google API Services User Data Policy and the Google Cloud Data Processing Addendum as above
- Stripe — Stripe Data Processing Agreement
- Resend — Resend Data Processing Agreement
- Sentry — Sentry Data Processing Addendum
- PostHog — PostHog Data Processing Agreement
- Vercel — Vercel Data Processing Addendum
- Cloudflare — Cloudflare Data Processing Addendum and Turnstile Privacy Addendum
- Trustpilot — Trustpilot Data Processing Agreement
Categories of personal data, by source
To help you audit the flows at a glance:
Business-customer data (where you are the data subject)
- Handled by: Google Cloud, Stripe, Resend (transactional), Sentry (error traces), PostHog (dashboard analytics), Vercel (login page), Cloudflare (sign-up and waitlist forms, before an account exists), Trustpilot (review invitation after a paid plan purchase)
End-customer data (where a business is the controller and FaveCard is the processor on their behalf)
- Handled by: Google Cloud, Apple APNs, Google Wallet API, Resend (pass-ready email), Vercel (card signup page)
- Not shared with: PostHog (dashboard-scoped analytics), Cloudflare (sign-up and waitlist forms only), Trustpilot (business customers only)
Technical operational data (logs, diagnostics, metrics)
- Handled by: Google Cloud (logs), Sentry (error traces), PostHog (dashboard behaviour), Vercel (edge logs)
What is not a sub-processor
The following third parties interact with the FaveCard ecosystem but are not sub-processors for the purposes of Article 28 GDPR, because they do not process personal data on FaveCard's behalf:
- Apple Wallet and Google Wallet end-user applications — these apps run on the end-customer's own device and receive the pass after delivery; Apple and Google in their capacity as wallet platforms are independent controllers of the wallet-app data. (Apple APNs and Google Wallet API, which are upstream services that FaveCard actively calls, are sub-processors — see items 2 and 3.)
- Domain registrar and DNS provider (GoDaddy) — handles only DNS records, does not process personal data.
- Banks and card networks (Visa, Mastercard, etc.) — handle payment data as independent controllers downstream of Stripe.
History of changes
This page maintains a log of all additions, removals, and material changes to the sub-processor list, for the benefit of customers auditing back in time.
| Date | Change | Notes |
|---|---|---|
| 2026-10-22 | Added Trustpilot A/S | Review invitations after a paid plan purchase. The buyer's email address, first name, business name and the language of the email; no end-customer data. |
| 2026-10-19 | Added Cloudflare, Inc. (Turnstile) | Bot protection on the sign-up and waitlist forms. No end-customer data and no data of existing accounts. |
| 2026-04-21 | Initial publication of Sub-processors List v1.0 | First version |
| 2026-04-20 | Removed Loops (Astrodon Corporation) | Marketing email service discontinued; no longer processing data |
Prior versions of this page are archived at favecard.co/legal/subprocessors/archive.
Contact
For questions about this list, to subscribe to change notifications, or to object to a specific sub-processor:
Qualityc Łukasz Fryc Kasinka Mała 472 34-734 Kasinka Mała Poland
NIP: 7372138804 EU VAT: PL7372138804 Email: privacy@favecard.co